Use AWS IAM Identity Center to assign or revoke permission sets for AWS accounts, resolve users and groups, and inspect account access.
The same operations support the reverse direction — access review. Starting from an account, an agent can list its assignments, resolve the principals, expand groups into their members, and produce a written report of exactly who can reach that account and through which permission set.
AWS requires a permission set ARN alongside the account ID on this call, so List Assignments For Account returns only the assignments granted through that one permission set — not every assignment on the account. To cover an account completely, run List Permission Sets for the instance first, then call List Assignments For Account once per permission set and combine the results. Skipping that loop silently omits access granted through the permission sets you did not ask about.
Creating and deleting an account assignment are asynchronous : both return a request ID, and each has its own status poller — use Check Assignment Status for creations and Check Assignment Deletion Status for deletions, as the two request-ID types are not interchangeable. And the account-listing operations call AWS Organizations, which is global per partition; the block resolves the correct endpoint for commercial, GovCloud, and China regions automatically.
Assign and revoke access to AWS accounts via IAM Identity Center (SSO). Assign permission sets to users or groups, look up users by email, and list accounts and permission sets for access request workflows.
List all AWS IAM Identity Center instances in your account
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key maxResultsnumber No Maximum number of instances to return (1-100) nextTokenstring No Pagination token from a previous request
Parameter Type Description instancesarray Identity Center instances in the region ↳ instanceArn string ARN of the Identity Center instance ↳ identityStoreId string Identity Store ID backing the instance ↳ name string Instance name ↳ status string Instance status ↳ statusReason string Explanation when the instance is not ACTIVE ↳ ownerAccountId string AWS account that owns the instance ↳ createdDate string ISO 8601 date the instance was created nextTokenstring Pagination token for the next page of results countnumber Number of instances returned
List all AWS accounts in your organization
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key maxResultsnumber No Maximum number of accounts to return (1-20; the AWS Organizations ceiling) nextTokenstring No Pagination token from a previous request
Parameter Type Description accountsarray Accounts in the AWS organization ↳ id string AWS account ID ↳ arn string AWS account ARN ↳ name string Account name ↳ email string Root email address of the account ↳ status string Account status (e.g., ACTIVE, SUSPENDED) ↳ joinedTimestamp string ISO 8601 date the account joined the organization nextTokenstring Pagination token for the next page of results countnumber Number of accounts returned
Retrieve details about a specific AWS account by its ID
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key accountIdstring Yes AWS account ID to describe
Parameter Type Description idstring AWS account ID arnstring AWS account ARN namestring Account name emailstring Root email address of the account statusstring Account status (ACTIVE, SUSPENDED, etc.) joinedTimestampstring Date the account joined the organization
List all permission sets defined in an IAM Identity Center instance
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key instanceArnstring Yes ARN of the Identity Center instance maxResultsnumber No Maximum number of permission sets to return (1-100) nextTokenstring No Pagination token from a previous request
Parameter Type Description permissionSetsarray Permission sets defined on the instance ↳ permissionSetArn string ARN of the permission set ↳ name string Permission set name ↳ description string Permission set description ↳ sessionDuration string ISO 8601 session duration (e.g., PT1H) ↳ createdDate string ISO 8601 date the permission set was created nextTokenstring Pagination token for the next page of results countnumber Number of permission sets returned
Look up a user in the Identity Store by email address
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key identityStoreIdstring Yes Identity Store ID (from the Identity Center instance) emailstring Yes Email address of the user to look up
Parameter Type Description userIdstring Identity Store user ID (use as principalId) userNamestring Username in the Identity Store displayNamestring Display name of the user emailstring Email address of the user
Resolve an Identity Store user ID to the user behind it. Use to turn the principalId on an account assignment into a name and email.
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key identityStoreIdstring Yes Identity Store ID (e.g., d-1234567890) userIdstring Yes Identity Store user ID, such as the principalId on a USER account assignment
Parameter Type Description userIdstring Identity Store user ID userNamestring Username in the Identity Store displayNamestring Display name of the user, or null when the Identity Store omits it emailstring Primary email address, or null when the user has no email attribute userStatusstring Account status (ENABLED or DISABLED), or null when the Identity Store omits it titlestring Job title, or null when the Identity Store omits it externalIdsarray External identity provider IDs linked to the user ↳ issuer string Identity provider that issued the ID ↳ id string Identifier at the issuer
Look up a group in the Identity Store by display name
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key identityStoreIdstring Yes Identity Store ID (from the Identity Center instance) displayNamestring Yes Display name of the group to look up
Parameter Type Description groupIdstring Identity Store group ID (use as principalId) displayNamestring Display name of the group descriptionstring Group description
Resolve an Identity Store group ID to the group behind it. Use to turn the principalId on an account assignment into a group name.
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key identityStoreIdstring Yes Identity Store ID (e.g., d-1234567890) groupIdstring Yes Identity Store group ID, such as the principalId on a GROUP account assignment
Parameter Type Description groupIdstring Identity Store group ID displayNamestring Display name of the group descriptionstring Group description externalIdsarray External identity provider IDs linked to the group ↳ issuer string Identity provider that issued the ID ↳ id string Identifier at the issuer
List all groups in the Identity Store
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key identityStoreIdstring Yes Identity Store ID (from the Identity Center instance) maxResultsnumber No Maximum number of groups to return (1-100) nextTokenstring No Pagination token from a previous request
Parameter Type Description groupsarray Groups in the Identity Store ↳ groupId string Identity Store group ID (use as principalId) ↳ displayName string Group display name ↳ description string Group description ↳ externalIds array External identity provider IDs linked to the group ↳ issuer string Identity provider that issued the ID ↳ id string Identifier at the issuer nextTokenstring Pagination token for the next page of results countnumber Number of groups returned
List the users who belong to an Identity Store group
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key identityStoreIdstring Yes Identity Store ID (e.g., d-1234567890) groupIdstring Yes Identity Store group ID whose members to list maxResultsnumber No Maximum number of memberships to return (1-100) nextTokenstring No Pagination token from a previous request
Parameter Type Description membershipsarray Members of the group ↳ membershipId string Identity Store membership ID ↳ groupId string Identity Store group ID ↳ userId string Identity Store user ID of the member — resolve with Describe User. Null when the member is not a user. nextTokenstring Pagination token for the next page of results countnumber Number of memberships returned
Grant a user or group access to an AWS account via a permission set (temporary elevated access)
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key instanceArnstring Yes ARN of the Identity Center instance accountIdstring Yes AWS account ID to grant access to permissionSetArnstring Yes ARN of the permission set to assign principalTypestring Yes Type of principal: USER or GROUP principalIdstring Yes Identity Store ID of the user or group
Parameter Type Description messagestring Status message statusstring Provisioning status: IN_PROGRESS, FAILED, or SUCCEEDED requestIdstring Request ID to use with Check Assignment Status accountIdstring Target AWS account ID permissionSetArnstring Permission set ARN principalTypestring Principal type (USER or GROUP) principalIdstring Principal ID failureReasonstring Reason for failure if status is FAILED createdDatestring Date the request was created
Revoke a user or group access to an AWS account by removing a permission set assignment
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key instanceArnstring Yes ARN of the Identity Center instance accountIdstring Yes AWS account ID to revoke access from permissionSetArnstring Yes ARN of the permission set to remove principalTypestring Yes Type of principal: USER or GROUP principalIdstring Yes Identity Store ID of the user or group
Parameter Type Description messagestring Status message statusstring Deprovisioning status: IN_PROGRESS, FAILED, or SUCCEEDED requestIdstring Request ID to use with Check Assignment Deletion Status accountIdstring Target AWS account ID permissionSetArnstring Permission set ARN principalTypestring Principal type (USER or GROUP) principalIdstring Principal ID failureReasonstring Reason for failure if status is FAILED createdDatestring Date the request was created
Check the provisioning status of an account assignment creation request
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key instanceArnstring Yes ARN of the Identity Center instance requestIdstring Yes Request ID returned from Create Account Assignment. Deletion request IDs are not accepted — use Check Assignment Deletion Status for those.
Parameter Type Description messagestring Human-readable status message statusstring Current status: IN_PROGRESS, FAILED, or SUCCEEDED requestIdstring The request ID that was checked accountIdstring Target AWS account ID permissionSetArnstring Permission set ARN principalTypestring Principal type (USER or GROUP) principalIdstring Principal ID failureReasonstring Reason for failure if status is FAILED createdDatestring Date the request was created
Check the deprovisioning status of an account assignment deletion request
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key instanceArnstring Yes ARN of the Identity Center instance requestIdstring Yes Request ID returned from Delete Account Assignment
Parameter Type Description messagestring Human-readable status message statusstring Current deletion status: IN_PROGRESS, FAILED, or SUCCEEDED requestIdstring The deletion request ID that was checked accountIdstring Target AWS account ID permissionSetArnstring Permission set ARN principalTypestring Principal type (USER or GROUP) principalIdstring Principal ID failureReasonstring Reason for failure if status is FAILED createdDatestring Date the request was created
List every account and permission set a specific user or group is assigned. Use List Assignments For Account to go the other way, from an account to its principals.
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key instanceArnstring Yes ARN of the Identity Center instance principalIdstring Yes Identity Store ID of the user or group principalTypestring Yes Type of principal: USER or GROUP maxResultsnumber No Maximum number of assignments to return (1-100) nextTokenstring No Pagination token from a previous request
Parameter Type Description assignmentsarray Accounts and permission sets the principal is assigned ↳ accountId string AWS account ID ↳ permissionSetArn string Permission set ARN ↳ principalType string Principal type (USER or GROUP) ↳ principalId string Identity Store user or group ID nextTokenstring Pagination token for the next page of results countnumber Number of assignments returned
List every principal assigned a specific permission set on a specific AWS account. Use for per-account access reviews.
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key instanceArnstring Yes ARN of the Identity Center instance accountIdstring Yes AWS account ID to list assignments for (12 digits) permissionSetArnstring Yes ARN of the permission set to list assignments for maxResultsnumber No Maximum number of assignments to return (1-100) nextTokenstring No Pagination token from a previous request
Parameter Type Description assignmentsarray Principals assigned this permission set on the account ↳ accountId string AWS account ID ↳ permissionSetArn string Permission set ARN ↳ principalType string Principal type (USER or GROUP) ↳ principalId string Identity Store user or group ID — resolve with Describe User or Describe Group nextTokenstring Pagination token for the next page of results countnumber Number of assignments returned